consul

Commit Graph

Author	SHA1	Message	Date
Andrea Scarpino	bf601842c2	docs: document consulPrefix properly (#7603 )	5 years ago
danielehc	0fef193278	Adding API version for example call (#7626 )	5 years ago
Hans Hasselberg	66415be90e	connect: support envoy 1.14.1 (#7624 )	5 years ago
Pierre Souchay	4a6569a4e3	tests: change default http_max_conns_per_client to 250 to ease tests (#7625 ) On recent Mac OS versions, the ulimit defaults to 256 by default, but many systems (eg: some Linux distributions) often limit this value to 1024. On validation of configuration, Consul now validates that the number of allowed files descriptors is bigger than http_max_conns_per_client. This make some unit tests failing on Mac OS. Use a less important value in unit test, so tests runs well by default on Mac OS without need for tuning the OS.	5 years ago
Blake Covarrubias	7f03949424	docs: Fix broken link to Nomad Consul Connect guide	5 years ago
Freddy	9eb1867fbb	Terminating gateway discovery (#7571 ) * Enable discovering terminating gateways * Add TerminatingGatewayServices to state store * Use GatewayServices RPC endpoint for ingress/terminating	5 years ago
Freddy	aae14b3951	Add decode rules for Expose cfg in service-defaults (#7611 )	5 years ago
Iryna Shustava	74bd138bae	docs: Add Helm docs for auto-encrypt and external servers (#7595 ) * docs: Add Helm docs for auto-encrypt and external servers	5 years ago
Luke Kysow	c03e314c16	Merge pull request #7586 from hashicorp/helm-docs Document bootstrapACLs deprecation	5 years ago
Alvin Huang	1bb4e1ccd2	filter out non go branches from the 'go-tests' workflow (#7606 )	5 years ago
Matt Keeler	32daa2b27c	Update CHANGELOG.md	5 years ago
Matt Keeler	0e7d3d93b3	Enable filtering language support for the v1/connect/intentions… (#7593 ) * Enable filtering language support for the v1/connect/intentions listing API * Update website for filtering of Intentions * Update website/source/api/connect/intentions.html.md	5 years ago
Daniel Nephin	8549cc2d99	Merge pull request #7598 from pierresouchay/preallocation_of_dns_meta Pre-allocations of DNS meta to avoid several allocations	5 years ago
Luke Kysow	df9d88831d	Update website/source/docs/platform/k8s/helm.html.md Co-Authored-By: Iryna Shustava <ishustava@users.noreply.github.com>	5 years ago
Pierre Souchay	d1d016d61d	[LINT] Close resp.Body to avoid linter complaining (#7600 )	5 years ago
Pierre Souchay	c9e01ed0a3	Pre-allocations of DNS meta to avoid several allocations	5 years ago
Jono Sosulska	93509690be	Change style to match "join" singular (#7569 ) * Change style to match "join" singular - Replaced "(Consul) cluster" with "Consul Datacenter" - Removed "ing" so the feature fits "Consul Auto-join", and that the tense is correct. Co-authored-by: danielehc <40759828+danielehc@users.noreply.github.com>	5 years ago
David Yu	b51ad875c3	[docs] Built-in Proxies not meant for production (#7579 ) * [docs] Built-in Proxies not meant for production * Adding link to Envoy for Connect * Update website/source/docs/connect/proxies/built-in.md Co-Authored-By: Blake Covarrubias <blake@covarrubi.as> * Revising note * Update website/source/docs/connect/proxies/built-in.md period Co-Authored-By: Hans Hasselberg <me@hans.io> Co-authored-by: Blake Covarrubias <blake@covarrubi.as> Co-authored-by: Hans Hasselberg <me@hans.io>	5 years ago
Daniel Nephin	b9cb1e93c3	Merge pull request #7589 from pierresouchay/fix_unstable_test_TestForwardSignals Fixed unstable test TestForwardSignals()	5 years ago
Pierre Souchay	73056fecf8	Fixed unstable test TestForwardSignals() Sometimes, in the CI, it could receive a SIGURG, producing this line: FAIL: TestForwardSignals/signal-interrupt (0.06s) util_test.go:286: expected to read line "signal: interrupt" but got "signal: urgent I/O condition" Only forward the signals we test to avoid this kind of false positive Example of such unstable errors in CI: https://circleci.com/gh/hashicorp/consul/153571	5 years ago
Pierre Souchay	09e638a9c6	tests: more tolerance to latency for unstable test `TestCacheNotifyPolling()`. (#7574 )	5 years ago
Luke Kysow	08df582e20	Document bootstrapACLs deprecation	5 years ago
Freddy	b61214ef24	Fix regression with gateway registration and update docs (#7582 )	5 years ago
Matt Keeler	8aec09aa8f	Ensure that token clone copies the roles (#7577 )	5 years ago
Chris Piraino	bcb7a89fda	Update CHANGELOG.md	5 years ago
Chris Piraino	584f90bbeb	Fix flapping of mesh gateway connect-service watches (#7575 )	5 years ago
Pierre Souchay	2a8bf45e38	agent: show warning when enable_script_checks is enabled without safty net (#7437 ) In order to enforce a bit security on Consul agents, add a new method in agent to highlight possible security issues. This does not return an error for now, but might in the future. For now, it detects issues such as: https://www.hashicorp.com/blog/protecting-consul-from-rce-risk-in-specific-configurations/ This would display this kind of messages: ``` 2020-03-11T18:27:49.873+0100 [ERROR] agent: [SECURITY] issue: error="using enable-script-checks without ACLs and without allow_write_http_from is DANGEROUS, use enable-local-script-checks instead see https://www.hashicorp.com/blog/protecting-consul-from-rce-risk-in-specific-configurations/" ```	5 years ago
Andy Lindeman	fb0a990e4d	agent: rewrite checks with proxy address, not local service address (#7518 ) Exposing checks is supposed to allow a Consul agent bound to a different IP address (e.g., in a different Kubernetes pod) to access healthchecks through the proxy while the underlying service binds to localhost. This is an important security feature that makes sure no external traffic reaches the service except through the proxy. However, as far as I can tell, this is subtly broken in the case where the Consul agent cannot reach the proxy over localhost. If a proxy is configured with: `{ LocalServiceAddress: "127.0.0.1", Checks: true }`, as is typical with a sidecar proxy, the Consul checks are currently rewritten to `127.0.0.1:<random port>`. A Consul agent that does not share the loopback address cannot reach this address. Just to make sure I was not misunderstanding, I tried configuring the proxy with `{ LocalServiceAddress: "<pod ip>", Checks: true }`. In this case, while the checks are rewritten as expected and the agent can reach the dynamic port, the proxy can no longer reach its backend because the traffic is no longer on the loopback interface. I think rewriting the checks to use `proxy.Address`, the proxy's own address, is more correct in this case. That is the IP where the proxy can be reached, both by other proxies and by a Consul agent running on a different IP. The local service address should continue to use `127.0.0.1` in most cases.	5 years ago
Andy Lindeman	c1cb18c648	proxycfg: support path exposed with non-HTTP2 protocol (#7510 ) If a proxied service is a gRPC or HTTP2 service, but a path is exposed using the HTTP1 or TCP protocol, Envoy should not be configured with `http2ProtocolOptions` for the cluster backing the path. A situation where this comes up is a gRPC service whose healthcheck or metrics route (e.g. for Prometheus) is an HTTP1 service running on a different port. Previously, if these were exposed either using `Expose: { Checks: true }` or `Expose: { Paths: ... }`, Envoy would still be configured to communicate with the path over HTTP2, which would not work properly.	5 years ago
Pierre Souchay	be1c5c4b48	config: validate system limits against limits.http_max_conns_per_client (#7434 ) I spent some time today on my local Mac to figure out why Consul 1.6.3+ was not accepting limits.http_max_conns_per_client. This adds an explicit check on number of file descriptors to be sure it might work (this is no guarantee as if many clients are reaching the agent, it might consume even more file descriptors) Anyway, many users are fighting with RLIMIT_NOFILE, having a clear message would allow them to figure out what to fix. Example of message (reload or start): ``` 2020-03-11T16:38:37.062+0100 [ERROR] agent: Error starting agent: error="system allows a max of 512 file descriptors, but limits.http_max_conns_per_client: 8192 needs at least 8212" ```	5 years ago
Daniel Nephin	a6cede401a	Merge pull request #7572 from hashicorp/dnephin/ci-fix-go-mod-download ci: Fix working_directory for go mod download	5 years ago
Daniel Nephin	625ce9baf2	ci: Fix working_directory for go mod download The previous PR which added these was accidentally performing the download in the root directory. For the api, and sdk directories it should be in done in the same directory that will be used to run tests. Otherwise the wrong dependencies will be downloaded which may add unnecessary time to the CI run.	5 years ago
Shaker Islam	ac309d55f4	docs: document exported functions in agent.go (closes #7101 ) (#7366 ) and fix one linter error	5 years ago
R.B. Boyer	c2f4063103	update changelog	5 years ago
Pierre Souchay	5703aadb59	[BUGFIX] Fix race condition in freeport (#7567 ) This removes a race condition in reset since pendingPorts can be set to nil in reset() If ticker is hit at wrong time, it would crash the unit test. We ensure in reset to avoid this race condition by cancelling the goroutine using killTicker chan. We also properly clean up eveything, so garbage collector can work as expected. To reproduce existing bug: `while go test -timeout 30s github.com/hashicorp/consul/sdk/freeport -run '^(Test.)$'; do go clean -testcache; done` Will crash after a few 10s runs on my machine. Error could be seen in unit tests sometimes: [INFO] freeport: resetting the freeport package state panic: runtime error: invalid memory address or nil pointer dereference [signal SIGSEGV: segmentation violation code=0x1 addr=0x28 pc=0x1125536] goroutine 25 [running]: container/list.(List).Len(...) /usr/local/Cellar/go/1.14/libexec/src/container/list/list.go:66 github.com/hashicorp/consul/sdk/freeport.checkFreedPortsOnce() /Users/p.souchay/go/src/github.com/hashicorp/consul/sdk/freeport/freeport.go:157 +0x86 github.com/hashicorp/consul/sdk/freeport.checkFreedPorts() /Users/p.souchay/go/src/github.com/hashicorp/consul/sdk/freeport/freeport.go:147 +0x71 created by github.com/hashicorp/consul/sdk/freeport.initialize /Users/p.souchay/go/src/github.com/hashicorp/consul/sdk/freeport/freeport.go:113 +0x2cf FAIL github.com/hashicorp/consul/sdk/freeport 1.607s	5 years ago
Daniel Nephin	fce56e4cb6	Merge pull request #7570 from pierresouchay/fix_lint_upstream_due_to_change_args_in_NewTestAgent [FIX BUILD] fix build due to merge of #7562	5 years ago
Pierre Souchay	08acd6a03e	[FIX BUILD] fix build due to merge of #7562 Due to merge #7562, upstream does not compile anymore. Error is: ERRO Running error: gofmt: analysis skipped: errors in package: [/Users/p.souchay/go/src/github.com/hashicorp/consul/agent/config_endpoint_test.go:188:33: too many arguments]	5 years ago
Daniel Nephin	0d8edc3e27	Merge pull request #7562 from hashicorp/dnephin/remove-tname-from-name testing: Remove old default value from NewTestAgent() calls	5 years ago
Daniel Nephin	76f03982eb	Merge pull request #7427 from hashicorp/dnephin/website-fix-errrors-in-upgrade-docs docs: fix some errors in upgrade-specific	5 years ago
Daniel Nephin	2c631a7a78	Merge pull request #7465 from hashicorp/dnephin/correct-docs-log-file docs: Update config reference for log-file	5 years ago
Daniel Nephin	5f44bbcac2	Merge pull request #7519 from hashicorp/dnephin/help-to-stdout cli: send requested help text to stdout	5 years ago
Daniel Nephin	190fc3c732	Merge pull request #7533 from hashicorp/dnephin/xds-server-1 agent/xds: small cleanup	5 years ago
Hans Hasselberg	efaf0f9a18	docs: revert "docs: fix param for register checks id->checkid (#7393 )" (#7565 ) This reverts commit `ed5202943e`.	5 years ago
Rasmus Mikkelsen	ed5202943e	docs: fix param for register checks id->checkid (#7393 )	5 years ago
John Cowen	8d4631526c	ui: Fix token duplication bug (#7552 ) We need to detect whether an object is an ember-data snapshot or just a plain object, and we where restricted from using `instanceof` due to ember-data's `Snapshot` class being private. We'd chosen to go with `constructor.name` instead, which seemed to work, but when the javascript gets minifed the name of the contructor is also minified and therefore is not what you are expecting. This commit reverts to our original idea of checking for the existence and type of the `.attributes` function, which is the function we require within the conditional, and therefore is more reliable (if the function doesn't exist it will error out during development aswell as production)	5 years ago
Emre Savcı	2083b7b04d	agent: add len, cap while initializing arrays	5 years ago
Pierre Souchay	4d35816bee	tests: fixed unstable test TestAPI_AgentMonitor (#7561 ) Similar fix as https://github.com/hashicorp/consul/pull/7541	5 years ago
Daniel Nephin	e759daafdd	Rename NewTestAgentWithFields to StartTestAgent This function now only starts the agent. Using: git grep -l 'StartTestAgent(t, true,' \| \ xargs sed -i -e 's/StartTestAgent(t, true,/StartTestAgent(t,/g'	5 years ago
Daniel Nephin	f9f6b14533	Convert the remaining calls to NewTestAgentWithFields After removing the t.Name() parameter with sed, convert the last few tests which use a custom name to call NewTestAgentWithFields instead.	5 years ago
Daniel Nephin	9d83a45663	Merge pull request #7557 from hashicorp/dnephin/ci-small-improvements ci: Upload coverage from each job	5 years ago

1 2 3 4 5 ...

11185 Commits (bf601842c21bf1abe0bf2bd56f996102d4aeb91c) All Branches Search

11185 Commits (bf601842c21bf1abe0bf2bd56f996102d4aeb91c)

All Branches